VBS_TELEBOT.A

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• !cmd - Execute shell command w/o feedback
• !cmdd - Execute shell command w/ feedback
• !dump - Decode and save receive data
• !timeout - Set sleep time
• !bye - Terminate itself
• !kill - Delete and terminate itself
• !up - Upload file

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}.{BLOCKED}.137.212:80/Micrsoft/Outlook/initialization
• http://{BLOCKED}.{BLOCKED}.137.212:80/Micrsoft/Office/validation?{params}
  where {params} is encoded string of the following data:
  
  • m={mac_address}&n={hostname}&t={sleeptime}&r={random}

However, as of this writing, the said sites are inaccessible.

Download Routine

This backdoor saves the files it downloads using the following names:

• %User Temp%\~DE{random}.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Information Theft

This backdoor gathers the following data:

• Host Name
• MAC Address

Stolen Information

This backdoor sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}.{BLOCKED}.137.212:80/Micrsoft/Updates/kbupdate

Other Details

This backdoor drops the following file(s)/component(s):

• %User Temp%\~DF{random}.tmp ← log files; deleted afterwards

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)